{: .info} tl;dr: Some notes to self on state-of-the-art witness encryption (WE) schemes.

$ \def\adp{\mathsf{ADP}} \def\aadp{\mathsf{AADP}} \def\eval{\mathsf{eval}} \def\x{\mathbf{x}} \def\M{\mathsf{M}} \def\A{\mathbf{A}} \def\B{\mathbf{B}} \def\R{\mathbf{R}} \def\Rvss{\mathcal{R}_\mathsf{vss}} \def\Radp#1{\mathcal{R}_\mathsf{adp}^{#1}} \def\span{\mathsf{span}} \def\Fbar{\bar{\F}} $

{% include defs-zkp.md %}

Related work

WE is implied by indistinguishability-obfuscation (iO) but it is weaker than iO[^GMM17e].

Affine determinant programs (ADPs)

Bartusek et al.[^BIJplus20e] introduced affine determinant programs (ADPs) as key building block for WE and for iO.

An ADP is a function: